CVE-2022-2856 - Chrome Intents flaw exploited in the wild

A new release of Chrome includes a patch for CVE-2022-2856. It is based on insufficient validation of untrusted input in Intents. Intents are used to launch apps and can provide additional data. If an intent contains any extras or a data URI and it targets another browser, Google Chrome would open that browser with that URL without prompting. The fix makes the user explicitly choose to open the other browser. Google says an exploit for this bug exists in the wild. The vulnerability was discovered via Google Threat Analysis Group (TAG). Further details on specific threat actors have not been released so far.